PreparedStatement's with Oracle 8i....

[SAFROLE YUTANI]

I noticed that there is no need to escape special characters such as "'" when using PreparedStatements. In other words, the following code executes without error...
PreparedStatment st =
connection.prepareStatement( "INSERT INTO Product values ( ?,?)");
st.setInt( 1, 1);
st.setString( 2, "Hello ' World");
st.execute();
I'm assuming that the Oracle driver is aware of escaping special characters in string arguments, but I know for a fact that if I use Statement instead of PreparedStatement, I get an SQLException complaining about a string termination error.
I just want to confirm with you guys that PreparesStatement actually escapes strings automatically.
SAF

[Jamie Robertson]

That's the best feature of PreparedStatements, they handle special characters for you. Your assumptions are correct.
Jamie

[SAFROLE YUTANI]

oh yeah, that's the bomb!
thanks jamie
SAF